Answer-first summary for fast verification
Answer: Enable VPC Service Controls, create a perimeter around Projects A and B, and include the Cloud Storage API in the Service Perimeter configuration.
The question requires a defense-in-depth approach with three specific requirements: (1) Cloud Storage bucket in Project A can only be readable from Project B, (2) no external network access to the bucket, and (3) prevention of data copying to external Cloud Storage buckets. VPC Service Controls (Option B) is the optimal solution because it creates a service perimeter that restricts data egress and access to authorized projects (A and B) while preventing data exfiltration to external buckets. Option A (domain restricted sharing and uniform bucket-level access) does not prevent data copying to external buckets. Option C (Private Access with firewall rules) lacks perimeter-level data egress controls. Option D (VPC Peering with firewall rules) enables network connectivity but does not prevent data copying to external buckets, failing the third requirement. The community discussion strongly supports Option B with 100% consensus and upvoted comments emphasizing VPC Service Controls as the correct solution for creating secure perimeters around projects.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
Your security team needs to implement a defense-in-depth strategy for a sensitive Cloud Storage bucket in Project A with these requirements:
What steps should the security team take?
A
Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
B
Enable VPC Service Controls, create a perimeter around Projects A and B, and include the Cloud Storage API in the Service Perimeter configuration.
C
Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
D
Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.
No comments yet.